Catch me if you Scan

The talk starts from a common problem in macOS malware analysis: many samples on VirusTotal receive vague verdicts such as a generic Mac application or generic Trojan, which hides whether a file is a stealer, a backdoor, or something else. The presenters explain that these labels slow triage and distort prioritization, and that some backdoors appear fully undetected while their own model flags them. They also show detection trends from their telemetry, including a sharp rise in stealer and backdoor detections over the year.

Nazar Grycshuk then describes a multi-part system rather than a single algorithm. A static classifier, trained on a large and carefully aligned labelled dataset, predicts malware type, reporting a multi-class F1 score of about 0.96. Feature engineering draws on patterns distilled from analyst YARA rules and an internal feature library, and the team improves the model by reviewing the files it gets wrong. A second component is an embedding model trained with triplet loss, which places related samples close together so that individual files can be linked to collections and campaigns. As an example, two samples with different hashes but near-identical embeddings were both identified as Atomic Stealer.

Kseniia Yamburh covers the operational side, including daily dashboards that rank newly seen samples by harm and reduce manual analysis for reverse engineers. She closes with an invitation to collaborate on joint research and to give feedback on a beta app, and notes that the tool is still under development. The main takeaway for practitioners is the approach of combining machine learning with structured behavioural context to triage ambiguous macOS samples.